A researcher going by the handle mschwager on GitHub demonstrated an attack method that abuses the 'setup.py' file in Python modules to perform code execution when the package is installed.

This article looks at various ways to provide Python applications for others to consume. In some cases, the target user will have to install the Python runtime; in others, you can distribute the ...